# Elastic Agent

**URL:** https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=44

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 45

---

## [Elastic-agent as non-root - possible?](https://discuss.elastic.co/t/elastic-agent-as-non-root-possible/319321)

<div class="topic-metadata">

**Author:** [@el\_gg](https://discuss.elastic.co/u/el_gg)\
**Replies:** 2\
**Last updated:** [November 21, 2022, 1:14am UTC](https://discuss.elastic.co/t/elastic-agent-as-non-root-possible/319321 "2022-11-21T01:14:10Z")

</div>

Hi, We're doing a POC on the ELK stack and are now looking into the elastic-agent and fleet. Our install is on RHEL8 VMs. We now ran into this: Error: unable to perform install command, not executed with root permissi…

---

## [Error sending data to APM server: Read timed out, response code is -1](https://discuss.elastic.co/t/error-sending-data-to-apm-server-read-timed-out-response-code-is-1/319515)

<div class="topic-metadata">

**Author:** [@greeshma](https://discuss.elastic.co/u/greeshma)\
**Replies:** 0\
**Last updated:** [November 22, 2022, 7:23am UTC](https://discuss.elastic.co/t/error-sending-data-to-apm-server-read-timed-out-response-code-is-1/319515 "2022-11-22T07:23:15Z")

</div>

I have installed ELK 8.4.0 version and it is running successfully and installed elastic agent 1.8.1 version and apm server of 8.5 version. I have configured the tomcat application but while executing the server a found e…

---

## [GuardDuty en Elastic](https://discuss.elastic.co/t/guardduty-en-elastic/317442)

<div class="topic-metadata">

**Author:** [@Gonzalo\_Sandoval\_A](https://discuss.elastic.co/u/Gonzalo_Sandoval_A)\
**Replies:** 6\
**Last updated:** [November 21, 2022, 4:18pm UTC](https://discuss.elastic.co/t/guardduty-en-elastic/317442 "2022-11-21T16:18:07Z")

</div>

I am trying to create dashboard with information from AWS GuadDuty. I was already able to bring data to elastic through the elastic agent by enabling SQS integration from S3. The relevant information is in a field call…

---

## [Fleet-server cannot write to a fleet managed index](https://discuss.elastic.co/t/fleet-server-cannot-write-to-a-fleet-managed-index/318138)

<div class="topic-metadata">

**Author:** [@twilson](https://discuss.elastic.co/u/twilson)\
**Replies:** 1\
**Last updated:** [November 21, 2022, 2:33pm UTC](https://discuss.elastic.co/t/fleet-server-cannot-write-to-a-fleet-managed-index/318138 "2022-11-21T14:33:04Z")

</div>

I created a custom ingest pipeline (logs-system.security@custom) that looks for event ID 5152 or 5157 in the Windows security log, and redirects those events to the iptables indexes (logs-iptables.log-default), after mod…

---

## [Fail to checkin to fleet server](https://discuss.elastic.co/t/fail-to-checkin-to-fleet-server/318932)

<div class="topic-metadata">

**Author:** [@subash](https://discuss.elastic.co/u/subash)\
**Replies:** 7\
**Last updated:** [November 21, 2022, 1:42pm UTC](https://discuss.elastic.co/t/fail-to-checkin-to-fleet-server/318932 "2022-11-21T13:42:18Z")

</div>

We are using Elasticsearch 7.17.4 on private cloud. We have 4 elastic agents installed on windows 10 PCs and managed by fleet. It is observed that the Elastic agent status switches between 'Healthy' and 'Offline'. Belo…

---

## [Cmd/enroll\_cmd.go:776 Fleet Server - Error - x509: certificate is valid for (old hostname), not (current hostname)](https://discuss.elastic.co/t/cmd-enroll-cmd-go-776-fleet-server-error-x509-certificate-is-valid-for-old-hostname-not-current-hostname/318427)

<div class="topic-metadata">

**Author:** [@Foe\_Clicker](https://discuss.elastic.co/u/Foe_Clicker)\
**Replies:** 2\
**Last updated:** [November 21, 2022, 1:26pm UTC](https://discuss.elastic.co/t/cmd-enroll-cmd-go-776-fleet-server-error-x509-certificate-is-valid-for-old-hostname-not-current-hostname/318427 "2022-11-21T13:26:55Z")

</div>

Hi, I have the same issue like couple more people here, unfortinately they did not get any help, so I try myself:) Enrolling agent fails with message certificate is valid for (old hostname), not (current hostname). But…

---

## [Fleet data exporting to CSV](https://discuss.elastic.co/t/fleet-data-exporting-to-csv/318848)

<div class="topic-metadata">

**Author:** [@praveen\_raju](https://discuss.elastic.co/u/praveen_raju)\
**Replies:** 1\
**Last updated:** [November 21, 2022, 1:17pm UTC](https://discuss.elastic.co/t/fleet-data-exporting-to-csv/318848 "2022-11-21T13:17:52Z")

</div>

Hi, Is there way i can export Fleet data to CSV. I mean do we have a index for fleet for writing queries ?? my use case is i need to build a dashboard where it should show status of Elastic agent in each VM and way to …

---

## [Unable to install elastic agent for Fleet Server](https://discuss.elastic.co/t/unable-to-install-elastic-agent-for-fleet-server/318979)

<div class="topic-metadata">

**Author:** [@Tucker\_Green](https://discuss.elastic.co/u/Tucker_Green)\
**Replies:** 1\
**Last updated:** [November 21, 2022, 10:25am UTC](https://discuss.elastic.co/t/unable-to-install-elastic-agent-for-fleet-server/318979 "2022-11-21T10:25:55Z")

</div>

I keep getting the following error when trying to install the elastic agent so that I can get a fleet server up and running... I have tried adding the certificate authorities, and the troubleshooting docs don't help. Doe…

---

## [Adding more log directories to System Integration](https://discuss.elastic.co/t/adding-more-log-directories-to-system-integration/319237)

<div class="topic-metadata">

**Author:** [@ster1ingArch3r](https://discuss.elastic.co/u/ster1ingArch3r)\
**Replies:** 0\
**Last updated:** [November 17, 2022, 7:17pm UTC](https://discuss.elastic.co/t/adding-more-log-directories-to-system-integration/319237 "2022-11-17T19:17:28Z")

</div>

Heres what I have going on. I have created the elastic stack 3 nodes +a kibana Node which also is serving as my fleet server. I can deploy agents to new servers and endpoints and collect data from them. Unfortunately one…

---

## [Custom Logs integration, drop\_fields processor doesn't work](https://discuss.elastic.co/t/custom-logs-integration-drop-fields-processor-doesnt-work/319228)

<div class="topic-metadata">

**Author:** [@luca.derugeriis](https://discuss.elastic.co/u/luca.derugeriis)\
**Replies:** 0\
**Last updated:** [November 17, 2022, 5:16pm UTC](https://discuss.elastic.co/t/custom-logs-integration-drop-fields-processor-doesnt-work/319228 "2022-11-17T17:16:04Z")

</div>

Hi everyone, I'm trying get a drop\_fields processor working inside Custom Logs integration in Elastic Agent. This is my configuration in the "processors" text area in the integration page on kibana. - drop\_fields: …

---

## [Fleet agents go offline then return healty](https://discuss.elastic.co/t/fleet-agents-go-offline-then-return-healty/319206)

<div class="topic-metadata">

**Author:** [@mammodde](https://discuss.elastic.co/u/mammodde)\
**Replies:** 1\
**Last updated:** [November 17, 2022, 2:32pm UTC](https://discuss.elastic.co/t/fleet-agents-go-offline-then-return-healty/319206 "2022-11-17T14:32:02Z")

</div>

Hi, i have 3 agents other than the fleet server. this morning all 4 were healty, now 3 of them are labelled as offline (included the fleet server) and one of them is still healty. How is this possible? and why sometimes…

---

## [Nginx Ingress Controller Logs \[v1.2.0\] - Integration not working](https://discuss.elastic.co/t/nginx-ingress-controller-logs-v1-2-0-integration-not-working/319197)

<div class="topic-metadata">

**Author:** [@jolt](https://discuss.elastic.co/u/jolt)\
**Replies:** 0\
**Last updated:** [November 17, 2022, 1:12pm UTC](https://discuss.elastic.co/t/nginx-ingress-controller-logs-v1-2-0-integration-not-working/319197 "2022-11-17T13:12:18Z")

</div>

It appears that the Nginx Ingress Controller Logs integration - version 1.2.0 - is not working properly. The logs are being collected by k8s from the nginx-ingress-controller pods \[which default to outputting the error…

---

## [Win10 elastic agent "failed to fix permissions" error](https://discuss.elastic.co/t/win10-elastic-agent-failed-to-fix-permissions-error/319191)

<div class="topic-metadata">

**Author:** [@Vtech](https://discuss.elastic.co/u/Vtech)\
**Replies:** 0\
**Last updated:** [November 17, 2022, 12:38pm UTC](https://discuss.elastic.co/t/win10-elastic-agent-failed-to-fix-permissions-error/319191 "2022-11-17T12:38:14Z")

</div>

When attempting to install an elastic agent on Win10 server, I receive the following error messages Error: failed to fix permissions: The operation completed successfully. For help, please see our troubleshooting guide…

---

## [Fleet Server status stuck at updating, but seems to be working normally?!](https://discuss.elastic.co/t/fleet-server-status-stuck-at-updating-but-seems-to-be-working-normally/318193)

<div class="topic-metadata">

**Author:** [@martinm76](https://discuss.elastic.co/u/martinm76)\
**Replies:** 4\
**Last updated:** [November 17, 2022, 10:20am UTC](https://discuss.elastic.co/t/fleet-server-status-stuck-at-updating-but-seems-to-be-working-normally/318193 "2022-11-17T10:20:23Z")

</div>

Hello there. I recently updated a client system from 8.4.3 to 8.5.0. Everything was looking good, after the typical reindexing of shards until they were green or at least yellow. I then went to upgrade the Fleet Server…

---

## [Gather AWS tags for host running Elastic Agent](https://discuss.elastic.co/t/gather-aws-tags-for-host-running-elastic-agent/319125)

<div class="topic-metadata">

**Author:** [@keiransteele](https://discuss.elastic.co/u/keiransteele)\
**Replies:** 0\
**Last updated:** [November 16, 2022, 7:37pm UTC](https://discuss.elastic.co/t/gather-aws-tags-for-host-running-elastic-agent/319125 "2022-11-16T19:37:24Z")

</div>

Currently the only identifiable information when viewing a host in the fleet UI is the hostname and OS, there is some metadata available in the Observability UI (I think metrics needs to be enabled for this?) but there a…

---

## [Unable to edit settings for agent policy](https://discuss.elastic.co/t/unable-to-edit-settings-for-agent-policy/319096)

<div class="topic-metadata">

**Author:** [@mammodde](https://discuss.elastic.co/u/mammodde)\
**Replies:** 0\
**Last updated:** [November 16, 2022, 3:32pm UTC](https://discuss.elastic.co/t/unable-to-edit-settings-for-agent-policy/319096 "2022-11-16T15:32:03Z")

</div>

Hi, I am trying to install an elastic agent on an apache web server. The problem is that the server is outside my system's network. In order to make it work, I added an output in the fleet settings which should send da…

---

## [Elastic-agent not fond when running in Docker](https://discuss.elastic.co/t/elastic-agent-not-fond-when-running-in-docker/318948)

<div class="topic-metadata">

**Author:** [@Philip\_Davies1](https://discuss.elastic.co/u/Philip_Davies1)\
**Replies:** 0\
**Last updated:** [November 15, 2022, 10:44am UTC](https://discuss.elastic.co/t/elastic-agent-not-fond-when-running-in-docker/318948 "2022-11-15T10:44:29Z")

</div>

Hi All, I am running my ELK setup on a Docker Swarm cluster and I have Kibana, Elasticsearch, Metricbeats all up and running fine. I am trying to setup fleet and deploy my first elastic agent. The container for docker…

---

## [Fleet Agent - CEF Integration - Is there any way to listen on TCP?](https://discuss.elastic.co/t/fleet-agent-cef-integration-is-there-any-way-to-listen-on-tcp/318915)

<div class="topic-metadata">

**Author:** [@scanlan](https://discuss.elastic.co/u/scanlan)\
**Replies:** 3\
**Last updated:** [November 15, 2022, 7:57am UTC](https://discuss.elastic.co/t/fleet-agent-cef-integration-is-there-any-way-to-listen-on-tcp/318915 "2022-11-15T07:57:52Z")

</div>

I'm ingesting CEF based logs from another SIEM and utilizing the "Common Event Format (CEF)" integration. It is only able to receive CEF events via input file, or via UDP listener. There is no TCP listener option. A…

---

## [Generate alert for error message in metrics dataset](https://discuss.elastic.co/t/generate-alert-for-error-message-in-metrics-dataset/318888)

<div class="topic-metadata">

**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\
**Replies:** 0\
**Last updated:** [November 14, 2022, 5:48pm UTC](https://discuss.elastic.co/t/generate-alert-for-error-message-in-metrics-dataset/318888 "2022-11-14T17:48:44Z")

</div>

We have a situation where dockerd will periodically crash on a host, creating issues with jobs running in a timely fashion. Our application team would like to be notified when dockerd goes down. Unfortunately, we do not …

---

## [Agent List](https://discuss.elastic.co/t/agent-list/318673)

<div class="topic-metadata">

**Author:** [@branden.heifner](https://discuss.elastic.co/u/branden.heifner)\
**Replies:** 4\
**Last updated:** [November 14, 2022, 6:21pm UTC](https://discuss.elastic.co/t/agent-list/318673 "2022-11-14T18:21:40Z")

</div>

Hello, Is there an API or some other method to export a list of agents enrolled with the fleet server and their status (Healthy, Offline, etc.)? What I need to do is audit the agents currently enrolled with fleet with o…

---

## [Elastic\_agent.process not found](https://discuss.elastic.co/t/elastic-agent-process-not-found/317804)

<div class="topic-metadata">

**Author:** [@Xigrealf](https://discuss.elastic.co/u/Xigrealf)\
**Replies:** 5\
**Last updated:** [November 14, 2022, 6:21pm UTC](https://discuss.elastic.co/t/elastic-agent-process-not-found/317804 "2022-11-14T18:21:22Z")

</div>

Hello, I am currently trying to set up Elastic Stack. After i've installed elasticsearch, kibana and enrolled my elastic-agent to the fleet server i can see that my agent looks healthy in kibana but when i click view ag…

---

## [Elastic agents not showing up data for custom UDP integration](https://discuss.elastic.co/t/elastic-agents-not-showing-up-data-for-custom-udp-integration/318853)

<div class="topic-metadata">

**Author:** [@Pablo\_Sagrera\_Garcia](https://discuss.elastic.co/u/Pablo_Sagrera_Garcia)\
**Replies:** 0\
**Last updated:** [November 14, 2022, 10:23am UTC](https://discuss.elastic.co/t/elastic-agents-not-showing-up-data-for-custom-udp-integration/318853 "2022-11-14T10:23:11Z")

</div>

Hi I have a Fleet of Elastic Agents running on a fresh k8s cluster (running ECK 8.5.0). I added Custom UDP log integration (default namespace ,Listen port 9512 and Listen address 0.0.0.0,Dataset name: udp.generic) via K…

---

## [Elastic System Integration dashboard issue](https://discuss.elastic.co/t/elastic-system-integration-dashboard-issue/318549)

<div class="topic-metadata">

**Author:** [@subash](https://discuss.elastic.co/u/subash)\
**Replies:** 7\
**Last updated:** [November 11, 2022, 11:20pm UTC](https://discuss.elastic.co/t/elastic-system-integration-dashboard-issue/318549 "2022-11-11T23:20:40Z")

</div>

Mistakenly I have deleted the inbuilt dashboards of System integration with elastic. Is there any way that I can get those dashboards back?

---

## [Elastic 8.4 / PFSense Agent](https://discuss.elastic.co/t/elastic-8-4-pfsense-agent/318238)

<div class="topic-metadata">

**Author:** [@010101](https://discuss.elastic.co/u/010101)\
**Replies:** 2\
**Last updated:** [November 11, 2022, 1:39am UTC](https://discuss.elastic.co/t/elastic-8-4-pfsense-agent/318238 "2022-11-11T01:39:11Z")

</div>

So... I setup according to this pfSense | Elastic docs Pointed my firewall at ELK stack But 0 data Are there any instructions on how to get this going?

---

## [Network Condition Not Working?](https://discuss.elastic.co/t/network-condition-not-working/318369)

<div class="topic-metadata">

**Author:** [@chapmanjc](https://discuss.elastic.co/u/chapmanjc)\
**Replies:** 7\
**Last updated:** [November 10, 2022, 7:03pm UTC](https://discuss.elastic.co/t/network-condition-not-working/318369 "2022-11-10T19:03:10Z")

</div>

Hello all, I've set up an an Elastic Agent and I am using the Microsoft DHCP module. Everything is working great except there is a slight issue in regards to going into the "Advanced Options" inside of the Integration.…

---

## [Restart Elastic Agent from Fleet Centralized management](https://discuss.elastic.co/t/restart-elastic-agent-from-fleet-centralized-management/318646)

<div class="topic-metadata">

**Author:** [@frederikvandeputte](https://discuss.elastic.co/u/frederikvandeputte)\
**Replies:** 2\
**Last updated:** [November 10, 2022, 12:21pm UTC](https://discuss.elastic.co/t/restart-elastic-agent-from-fleet-centralized-management/318646 "2022-11-10T12:21:23Z")

</div>

Feature Request: Please add functionality to allow for elastic agent to be restarted remotely from Kibana - Fleet Centralized management, regardless of on which OS the agent is running on. Thanks KR

---

## [Elastic-agent add - error protocol integration http/https](https://discuss.elastic.co/t/elastic-agent-add-error-protocol-integration-http-https/318401)

<div class="topic-metadata">

**Author:** [@grillo](https://discuss.elastic.co/u/grillo)\
**Replies:** 4\
**Last updated:** [November 10, 2022, 11:54am UTC](https://discuss.elastic.co/t/elastic-agent-add-error-protocol-integration-http-https/318401 "2022-11-10T11:54:45Z")

</div>

Hi, I have created a security policy for a windows computer and now I want to associate the windows computers with the "elastic-agent"... I have installed it as a service and I have specified, as indicated... revision:…

---

## [Elastic Agent with Private Service connect](https://discuss.elastic.co/t/elastic-agent-with-private-service-connect/318613)

<div class="topic-metadata">

**Author:** [@Chris\_Pinto](https://discuss.elastic.co/u/Chris_Pinto)\
**Replies:** 2\
**Last updated:** [November 10, 2022, 9:40am UTC](https://discuss.elastic.co/t/elastic-agent-with-private-service-connect/318613 "2022-11-10T09:40:33Z")

</div>

Hi Team, Is there a way to add multiple fleet hosts endpoint in the fleet and create a separation based on the agent policies? Our current Elastic deployment hosted on Elastic cloud has default fleet hosts and the agen…

---

## [Error: fail to enroll: error 400 fleet-server BadRequest](https://discuss.elastic.co/t/error-fail-to-enroll-error-400-fleet-server-badrequest/317329)

<div class="topic-metadata">

**Author:** [@Mouc](https://discuss.elastic.co/u/Mouc)\
**Replies:** 3\
**Last updated:** [November 10, 2022, 7:41am UTC](https://discuss.elastic.co/t/error-fail-to-enroll-error-400-fleet-server-badrequest/317329 "2022-11-10T07:41:25Z")

</div>

Hello, After reading all the topics linked to my problem, i still could not solve it. My Elastic-Agent was installed correctly but the enrollment doesn't work, at first i only read the warning saying that remote server…

---

## [Trace capturing taking time after updating dynamic configuration](https://discuss.elastic.co/t/trace-capturing-taking-time-after-updating-dynamic-configuration/318612)

<div class="topic-metadata">

**Author:** [@sarthik](https://discuss.elastic.co/u/sarthik)\
**Replies:** 0\
**Last updated:** [November 10, 2022, 6:09am UTC](https://discuss.elastic.co/t/trace-capturing-taking-time-after-updating-dynamic-configuration/318612 "2022-11-10T06:09:36Z")

</div>

Trace capturing taking time after updating dynamic configuration. After I update instrumentation and recording both, there is a loss of trace data for some initial time. Is there a fixed span of time to wait after upda…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=43)

[Next page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=45)
